Summary
- UK and French governments launched the Pall Mall Process Industry Guidelines on 11 November.
- The framework addresses accountability, precision, oversight, and transparency in commercial intrusion capabilities.
- The guidance is non-binding and seeks to influence supplier and government behaviour.
Britain and France have introduced voluntary industry guidelines intended to strengthen accountability and oversight in the international market for commercial cyber intrusion capabilities.
The Pall Mall Process Industry Guidelines were launched at the initiative’s third conference in Paris on 11 November. They provide recommendations addressing the development, marketing, sale and use of commercial technologies designed to gain access to digital systems or information.
The framework is organised around four principles: accountability, precision, oversight and transparency. Its purpose is to encourage responsible conduct across the commercial intrusion market while making the obligations and expectations facing suppliers, purchasers and other participants more explicit.
The guidelines complement a code of practice for governments introduced in April 2025. The wider initiative began in February 2024, when the United Kingdom and France brought together governments, companies and civil society organisations to address risks arising from the proliferation and misuse of commercial intrusion capabilities.
A market beyond conventional cybersecurity services
Commercial cyber intrusion technology encompasses capabilities that may allow an operator to access devices, communications or digital information without the knowledge or consent of the person using the system. Such tools can support lawful investigations when properly authorised, but their use can also raise serious concerns about human rights, accountability and the security of the wider technology ecosystem.
The market involves more than the organisations that ultimately deploy the technology. Developers, brokers, resellers, distributors and supporting service providers can all influence how capabilities reach customers and whether meaningful restrictions accompany their transfer.
This creates a governance challenge that conventional software procurement does not fully address. Customers may seek powerful capabilities for investigative purposes, while suppliers must consider whether the buyer has appropriate legal authority, whether the intended use is proportionate and what safeguards exist against subsequent misuse.
The new framework attempts to establish common expectations across these relationships. It also reflects the difficulty of regulating a cross-border industry through national controls alone, particularly where technology can be developed in one jurisdiction, sold through another and deployed elsewhere.
Voluntary guidance and its limitations
The industry guidelines are not a binding international treaty. Their immediate influence depends on the willingness of companies and governments to adopt the recommended practices, incorporate them into procurement decisions and apply meaningful scrutiny to questionable transactions.
Publication of international guidance does not itself establish new criminal offences, require every commercial intrusion supplier to undergo certification or demonstrate that misuse has been prevented.
However, a shared framework can influence regulatory expectations and commercial due diligence. Governments purchasing intrusion capabilities may face stronger pressure to establish clear authorisation processes, while suppliers seeking contracts may increasingly need to demonstrate how their business practices address customer screening, oversight and the handling of misuse concerns.
Fourteen governments have endorsed the guidelines, including Austria, France, Germany, Italy, Japan, the Netherlands, Poland, Switzerland, the United Kingdom, and the United States. The framework remains voluntary, with its influence depending on implementation by suppliers, purchasers, and national authorities. Publication of the guidance does not itself establish new legal obligations or independent certification requirements.
Successful implementation would require more than supplier declarations. Effective oversight depends on the ability to assess how capabilities are sold, whether restrictions are enforceable and what happens when a purchaser or intermediary acts outside the intended framework.
The commercial intrusion industry also sits within a wider debate about vulnerability exploitation and disclosure. Tools designed to gain unauthorised technical access can depend on weaknesses that remain unpatched, creating tensions between investigative demand and the interests of other users exposed to the same defects.
The UK and French governments say the guidelines were developed through consultation with states, industry, academia and civil society. Their longer-term impact will depend on whether those principles become embedded in commercial conduct and public procurement, rather than remaining voluntary commitments with limited independent scrutiny.
